#!/bin/bash
#                    Autore Mauro T.
#=================== Inizio sviluppo 14 settembre 2006 ===========================
# nome file: postinstallazione_centos_i386-4.0.sh				 #
#				License GPL v.2					 #
# aggiungere le modifiche                                                        #
#										 #
#			                                                         #
##################################################################################

#------------------Inizio Procedura ---------------------------------------------

inizio() {

        echo " "
        echo "Hardening delle macchine STANDALONE a 32 bit"
        if [ $(id -u) -ne 0 ]; then
                echo "DEVI ESSERE ROOT PER ESEGUIRE L'HARDENING"
                echo "Premi invio per uscire"
                read
                exit 1
        fi
        echo
        echo -n "Premi invio per continuare"
        read
        echo

}

#------------------------------------------------------------------------------------

backup_file() {

        echo -n "Backup dei file... "
                mkdir -p /var/log/hardening
                cd /var/log/hardening
                cp /etc/securetty securetty.orig
                cp /etc/shadow shadow.orig
                cp /etc/passwd passwd.orig
                cp /etc/login.defs login.defs.orig
                cp /etc/profile profile.orig
                cp /etc/pam.d/su pam.d-su.orig
                cp /etc/inittab inittab.orig
                cp /etc/ssh/sshd_config sshd_config.orig
                cp /etc/sysctl.conf sysctl.conf.orig
                cp /etc/hosts hosts.orig
                find / -perm -4000 |grep -v /bin/su > uid.orig
                find / -perm -2000 > gid.orig
                cp /etc/fstab fstab.orig
        echo "backup effettuato."

}

#------------------------------------------------------------------------------------

modifica_file_generici() {

echo "Modifica file generici..."
echo "     /etc/hosts"
       IP=$(ifconfig|grep 10.6|head -1|cut -f2 -d:|awk '{print $1}')
       HN=$(uname -n)
       echo "127.0.0.1         localhost.localdomain localhost" >  /etc/hosts
       echo "$IP               $HN"                             >> /etc/hosts
       chmod 644 /etc/hosts
       chown root:root /etc/hosts

#----------------------------------------

echo "     /etc/securetty "
       echo "console" >  /etc/securetty
       echo "vc/1"    >> /etc/securetty
       echo "tty1"    >> /etc/securetty
       echo "tty2"    >> /etc/securetty
       echo "tty3"    >> /etc/securetty
       echo "tty4"    >> /etc/securetty
       echo "tty5"    >> /etc/securetty
       echo "tty6"    >> /etc/securetty
       chmod 600 /etc/securetty
       chown root:root /etc/securetty

#----------------------------------------

echo "     /etc/login.defs"
        sed -i /PASS_MIN_LEN/s/5/8/ /etc/login.defs
        echo "#Parametri aggiunti in post-installazione" >> /etc/login.defs
        echo "FAILLOG_ENAB yes" >>/etc/login.defs
        echo "SU_NAME su" >> /etc/login.defs
        echo "SYSLOG_SU_ENAB yes" >> /etc/login.defs
        echo "SYSLOG_SG_ENAB yes" >> /etc/login.defs
        echo "LOG_UNKFAIL_ENAB yes" >> /etc/login.defs
        echo "LOG_OK_LOGINS yes" >> /etc/login.defs
        echo "FTMP_FILE /var/log/btmp" >> /etc/login.defs

#----------------------------------------
echo "     /etc/profile"
        echo "TMOUT=7200" >> /etc/profile

#----------------------------------------
echo "     /etc/pam.d/su"
        sed -i '/pam_wheel.so use_uid/s/#auth/auth/' /etc/pam.d/su

#----------------------------------------
echo "     /etc/inittab"
        sed -i /ctrlaltdel/s/ca:/#ca:/ /etc/inittab


}

#----------------------------------------

sshd_conf() {
        echo "     /etc/ssh/sshd_config"
        cp /etc/ssh/sshd_config /etc/ssh/sshd_config.orig
        echo "Configuring SSH Server"
        FILE_CFG="/etc/ssh/sshd_config"
        PAR=(PermitRootLogin ServerKeyBits Protocol KeyRegenerationInterval Ciphers PasswordAuthentication RSAAuthentication RhostsAuthentication RhostsRSAAuthentication X11Forwarding PermitEmptyPasswords)
        VALUE=(no 1024 2 3600 aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc yes yes no no no no)
        NR_MAX=`echo ${#PAR[@]}`
        NR=0
        while test $NR -lt $NR_MAX
                do if test -z "`grep ^${PAR[$NR]} $FILE_CFG`"
                        then echo "${PAR[$NR]} ${VALUE[NR]}" >> $FILE_CFG
                        else VAL=`grep ^${PAR[$NR]} $FILE_CFG | awk '{print $2}'`
                               sed -i "/^${PAR[$NR]}/s/$VAL/${VALUE[$NR]}/" $FILE_CFG
                fi
        NR=$(($NR+1))
        done
}

#----------------------------------------

modifica_kernel() {

echo "     /etc/sysctl.conf"
        echo "net.ipv4.conf.all.accept_redirects = 0"           >> /etc/sysctl.conf
        echo "net.ipv4.conf.all.send_redirects = 0"             >> /etc/sysctl.conf
        echo "net.ipv4.conf.all.rp_filter = 1"                  >> /etc/sysctl.conf
        echo "net.ipv4.ip_forward = 0"                          >> /etc/sysctl.conf
        echo "net.ipv4.icmp_echo_ignore_broadcasts = 1"         >> /etc/sysctl.conf
        echo "net.ipv4.icmp_ignore_bogus_error_responses = 1"   >> /etc/sysctl.conf
        echo "net.ipv4.icmp_ratelimit = 100"                    >> /etc/sysctl.conf
        echo "net.ipv4.icmp_ratemask = 6168"                    >> /etc/sysctl.conf
        echo "net.ipv4.tcp_syncookies = 1"                      >> /etc/sysctl.conf
        echo "net.ipv4.tcp_adv_win_scale = 2"                   >> /etc/sysctl.conf
        echo "net.ipv4.tcp_sack = 1"                            >> /etc/sysctl.conf
        echo "net.ipv4.tcp_dsack = 1"                           >> /etc/sysctl.conf
        echo "net.ipv4.tcp_fin_timeout = 60"                    >> /etc/sysctl.conf
        echo "net.ipv4.tcp_retrans_collapse = 0"                >> /etc/sysctl.conf
        echo "net.ipv4.tcp_timestamps = 1"                      >> /etc/sysctl.conf
        echo "net.ipv4.tcp_window_scaling = 1"                  >> /etc/sysctl.conf

}

#-------------------------------------------------------------------------------

creazione_utenze () {

echo "Creazione Utenze... "
       newusers /root/postinstallazione/utenze.csv
       rm /root/postinstallazione/utenze.csv
       #groupadd dba
       #useradd -m -d /home/oracle     -g dba -s /bin/bash  oracle
       #chattr +i /etc/passwd /etc/shadow /etc/group

echo "Utenze Create. . . ."

}
#-------------------------------------------------------------------------------

modifica_permessi() {

echo -n "Modifica Permessi generici... "
        chmod -R g-w /etc
        chmod 600 /var/log
        chmod -R g-w /sbin
        chmod 700 /etc/init.d/*
        find / -perm -4000 -exec chmod u-s {} \;
        find / -perm -2000 -exec chmod g-s {} \;
        chmod u+s /bin/su
        chattr +i /etc/grub.conf /etc/services
#        chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow
echo "fatto Modifica Permessi generici... "

}

#-------------------------------------------------------------------------------

modifica_fstab() {

echo -n "Modifica /etc/fstab... "
        sed -i '/\/home/s/defaults/defaults,nodev,nosuid/' /etc/fstab
        sed -i '/ \/tmp/s/defaults/defaults,nodev,nosuid/' /etc/fstab
        sed -i '/\/usr /s/defaults/defaults,nodev/' /etc/fstab
        sed -i '/\/var /s/defaults/defaults,nodev/' /etc/fstab
        sed -i '/\/var\/log/s/defaults/defaults,nodev,nosuid,noexec/' /etc/fstab
        sed -i '/\/var\/tmp/s/defaults/defaults,nodev,nosuid/' /etc/fstab
        sed -i '/\/opt/s/defaults/defaults,nodev/' /etc/fstab
        sed -i '/\/appl-bin/s/defaults/defaults,nodev/' /etc/fstab
        sed -i '/\/appl-log/s/defaults/defaults,nodev,nosuid,noexec/' /etc/fstab
	echo "fatto Modifica fstab...

}

#-------------------------------------------------------------------------------
#  Spazio per nuova funzione
#
#-------------------------------------------------------------------------------



#-------------------------------------------------------------------------------

fine() {

echo
echo
echo "HARDENING EFFETTUATO... E\' ORA POSSIBILE REBOOTARE LA MACCHINA."

}


case "$1" in
inizio)
        inizio
        ;;
backup_file)
        backup_file
        ;;
modifica_file_generici)
        modifica_file_generici
        ;;
sshd_conf)
        sshd_conf
        ;;
modifica_kernel)
        modifica_kernel
        ;;
creazione_utenze)
        creazione_utenze
        ;;
modifica_permessi)
        modifica_permessi
        ;;
modifica_fstab)
        modifica_fstab
        ;;
all)
        inizio
        backup_file
        modifica_file_generici
        sshd_conf
        modifica_kernel
        creazione_utenze
        modifica_permessi
        modifica_fstab
	echo "tutto "
	fine
        ;;
status)
        echo ` ps -ef |grep postin`
        ;;
*)
        echo $"Usage: $0 {inizio|backup_file|modifica_file_generici|status|sshd_conf|modifica_kernel|creazione_utenze|modifica_permessi|modifica_fstab|all}"
        exit 1
esac

exit $RETVAL
